CryptNode 0.1.1

Managed multi-portal client for CryptPortal, with private FRP and stunnel executables.

Supported platforms

• Windows x86-64 with a trusted machine-level Python 3.8 or newer.
• Linux x86-64 with glibc 2.31 or newer and systemd; use a trusted virtual environment owned by the deployment user.
• Other architectures and macOS are not supported by these wheels.

Install

Linux, inside the intended virtual environment:

python -m pip install cryptnode==0.1.1
python -m cryptnode --version

Windows, from an administrator terminal using the intended machine-level Python:

python -s -m pip install --no-user cryptnode==0.1.1
python -s -m pip check
python -s -c "import cryptnode.host"
python -m cryptnode --version

Windows SYSTEM scheduled tasks must be able to read and execute that Python installation, CryptNode and its complete dependency set. User AppData installations are unsuitable. Using -s prevents pip from treating dependencies installed only in the interactive user's site-packages as satisfied. The Python environment and package files must not be writable by untrusted users. A successful import is a prerequisite, not an end-to-end scheduled-task test.

Dependencies: cryptography==43.0.3; Python versions below 3.11 also require tomli==2.2.1. pip installs their declared dependencies automatically.

Deploy and connect

crnode deploy <absolute-runtime-directory>
crnode load <two-digit-node-id> <client-key-bundle.zip>
crnode list
crnode status <portal-name-or-id> --json

On Windows, load and commands that modify SYSTEM tasks require an administrator terminal. Linux commands request sudo as needed while retaining the selected virtual environment. Obtain a matching client bundle from your CryptPortal administrator; credentials and server configuration are not included in this distribution. Protect client bundles and private keys.

Changes and validation limits

0.1.1 adds Linux sudo/virtual-environment usability improvements, prompt idempotent start for already-running instances, concise Ctrl+C handling and a five-column Chinese list display. Initial load and runtime public TLS connections use private stunnel with CA/hostname checks, mutual TLS and per-handshake server-leaf certificate pin verification.

The accepted candidate reports 107 passed/11 skipped on Windows, 99 passed/19 skipped on Linux, 20 private mTLS tests and 32 handshake combinations across Ubuntu 20.04/22.04/24.04/26.04. These results do not imply all deployment scenarios passed. A Windows deployment failed when SYSTEM could not import a user-installed package, and subsequently when a globally installed package still depended on user-only cryptography. Successful retesting of that machine remains unconfirmed. Host stderr retention and clearer startup diagnostics remain improvement items.

This release packaging preserves every accepted CryptNode Python file and executable byte. It adds distribution materials and documentation; no runtime fix is claimed by the repackaging.

Third-party source and licenses

Each wheel contains complete stunnel 5.80 and OpenSSL 3.5.8 upstream source archives, the exact stunnel modification patch, build scripts and build matrix under cryptnode-0.1.1.dist-info/corresponding-source/. Extract the wheel as a ZIP to access them. Full licenses and notices are under cryptnode-0.1.1.dist-info/licenses/.

Apply the supplied patch to the supplied stunnel source using the supplied platform build script. The patch changes Profile working-directory handling on Windows and adds per-handshake leaf-certificate pin checks; these modifications are identified in the patch and build matrix. The same archive contains all corresponding OpenSSL source statically linked into the private TLS executable. Neither archive contains deployment credentials.

FRP is Apache-2.0; stunnel is GPL-2.0-or-later with its upstream OpenSSL linking exception; OpenSSL is Apache-2.0. These notices describe the respective third-party components, not a new license grant for unrelated CryptNode code. Windows compiler-runtime copyright notices and exceptions are included separately.